Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

121–130 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#121

Post by briffle »

exabrial wrote: post #39
eadmund wrote: post #26

Earlier quoted context omitted.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

that sounds like an ideal candidate for orchestration tools like ansible, puppet, etc. Have them build/template out the config files for you

Re: WireGuard 1.0 for Linux 5.6

#122

Post by dzonga »

newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Algo vpn is the best way to set up wireguard.

Re: WireGuard 1.0 for Linux 5.6

#123

Post by mcdevilkiller »

newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

I id have some problems with algo behind a NAT. Though my usecase is a bit different, more of a road warrior, as I wanted to be able to access a server in one property (behind NAT) from my home PC (also NAT). I suppose I just need port forwarding.

Re: WireGuard 1.0 for Linux 5.6

#124

Post by api »

jeltz wrote: post #105
api wrote: post #98

Earlier quoted context omitted.

Good point. AES hardware acceleration makes a massive difference. It's why ZeroTier 2.x will use AES. Tiny boxes that lack HW acceleration are generally not used in cases where they're pushing enough bandwidth to matter anyway.

No, but boxes who lack hardware acceleration might care about battery life.

How many 32-bit ARM phones without AES units are there still around?

Re: WireGuard 1.0 for Linux 5.6

#125

Post by Florin_Andrei »

djsumdog wrote: post #103

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That…

> not needing to do the whole CA/easyrsa stuff is a huge bonus

That's good to hear, but how does it handle authentication / authorization?

Re: WireGuard 1.0 for Linux 5.6

#126

Post by PureParadigm »

Florin_Andrei wrote: post #125
djsumdog wrote: post #103

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That…

> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?

Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.

Re: WireGuard 1.0 for Linux 5.6

#127

Post by tjoff »

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard?

Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

Re: WireGuard 1.0 for Linux 5.6

#128

Post by stock_toaster »

felipelemos wrote: post #94
kitotik wrote: post #83

Earlier quoted context omitted.

Seems like a very long shot to make it into Apple products both because of the license and the fact it wasn’t invented in Cupertino. FWIW the userspace implementations are quite good, and still out performs IPSec.

I don't think there license would be a problem, as it's GPLv2, not v3. But the 'not invented here' syndrome is very real.

Boringtun is bsd licensed. clean room implementations and all that...

https://github.com/cloudflare/boringtun

Re: WireGuard 1.0 for Linux 5.6

#129

Post by MrStonedOne »

This is not an appropriate announcement post for a product, as it does not explain what the fuck a wireguard is, and given that it has been in beta up until now, the number of people who read hacker news and won't know what the fuck a wireguard is, is high enough to warrant only a proper announcement post for the product.

Re: WireGuard 1.0 for Linux 5.6

#130

Post by djclay »

tjoff wrote: post #127

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

The PiVPN project makes installing / administering WireGuard on the raspberry pi super easy - it has some scripts that nicely wrap WireGuard [1]. I'm not sure how generally applicable they are, but it might be a good starting point.

[1] https://github.com/pivpn/pivpn/tree/master/scripts/wireguard

Post reply on HN